8000 isFromTrustedProxy to confirm request came from a trusted proxy. · symfony/symfony@6c73f0c · GitHub
[go: up one dir, main page]
Skip to content

Commit 6c73f0c

Browse files
neclimdulfabpot
neclimdul
authored and
fabpot
committed
isFromTrustedProxy to confirm request came from a trusted proxy.
1 parent 9215c22 commit 6c73f0c

File tree

2 files changed

+34
-17
lines changed

2 files changed

+34
-17
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -791,7 +791,7 @@ public function getClientIps()
791791
{
792792
$ip = $this->server->get('REMOTE_ADDR');
793793

794-
if (!self::$trustedProxies) {
794+
if (!$this->isFromTrustedProxy()) {
795795
return array($ip);
796796
}
797797

@@ -957,7 +957,7 @@ public function getScheme()
957957
*/
958958
public function getPort()
959959
{
960-
if (self::$trustedProxies) {
960+
if ($this->isFromTrustedProxy()) {
961961
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
962962
return $port;
963963
}
@@ -1138,7 +1138,7 @@ public function getQueryString()
11381138
*/
11391139
public function isSecure()
11401140
{
1141-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
1141+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
11421142
return in_array(strtolower(current(explode(',', $proto))), array('https', 'on', 'ssl', '1'));
11431143
}
11441144

@@ -1166,7 +1166,7 @@ public function isSecure()
11661166
*/
11671167
public function getHost()
11681168
{
1169-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
1169+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
11701170
$elements = explode(',', $host);
11711171

11721172
$host = $elements[count($elements) - 1];
@@ -1853,4 +1853,9 @@ private function getUrlencodedPrefix($string, $prefix)
18531853

18541854
return false;
18551855
}
1856+
1857+
private function isFromTrustedProxy()
1858+
{
1859+
return self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);
1860+
}
18561861
}

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -722,35 +722,37 @@ public function testGetPort()
722722
'HTTP_X_FORWARDED_PROTO' => 'https',
723723
'HTTP_X_FORWARDED_PORT' => '8443',
724724
));
725-
$port = $request->getPort();
726-
727-
$this->assertEquals(8443, $port, 'With PROTO and PORT set PORT takes precedence.');
725+
$this->assertEquals(80, $request->getPort(), 'With PROTO and PORT on untrusted connection server value takes precedence.');
726+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
727+
$this->assertEquals(8443, $request->getPort(), 'With PROTO and PORT set PORT takes precedence.');
728728

729729
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
730730
'HTTP_X_FORWARDED_PROTO' => 'https',
731731
));
732-
$port = $request->getPort();
733-
734-
$this->assertEquals(443, $port, 'With only PROTO set getPort() defaults to 443.');
732+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set getPort() ignores trusted headers on untrusted connection.');
733+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
734+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set getPort() defaults to 443.');
735735

736736
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
737737
'HTTP_X_FORWARDED_PROTO' => 'http',
738738
));
739-
$port = $request->getPort();
740-
741-
$this->assertEquals(80, $port, 'If X_FORWARDED_PROTO is set to HTTP return 80.');
739+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() ignores trusted headers on untrusted connection.');
740+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
741+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() returns port of the original request.');
742742

743743
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
744744
'HTTP_X_FORWARDED_PROTO' => 'On',
745745
));
746-
$port = $request->getPort();
747-
$this->assertEquals(443, $port, 'With only PROTO set and value is On, getPort() defaults to 443.');
746+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is On, getPort() ignores trusted headers on untrusted connection.');
747+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
748+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is On, getPort() defaults to 443.');
748749

749750
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
750751
'HTTP_X_FORWARDED_PROTO' => '1',
751752
));
752-
$port = $request->getPort();
753-
$this->assertEquals(443, $port, 'With only PROTO set and value is 1, getPort() defaults to 443.');
753+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is 1, getPort() ignores trusted headers on untrusted connection.');
754+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
755+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is 1, getPort() defaults to 443.');
754756

755757
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
756758
'HTTP_X_FORWARDED_PROTO' => 'something-else',
@@ -1020,6 +1022,8 @@ public function testOverrideGlobals()
10201022
$request->headers->set('X_FORWARDED_PROTO', 'https');
10211023

10221024
Request::setTrustedProxies(array('1.1.1.1'));
1025+
$this->assertFalse($request->isSecure());
1026+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
10231027
$this->assertTrue($request->isSecure());
10241028
Request::setTrustedProxies(array());
10251029

@@ -1455,7 +1459,15 @@ public function testTrustedProxies()
14551459
$this->assertEquals(443, $request->getPort());
14561460
$this->assertTrue($request->isSecure());
14571461

1462+
// trusted proxy via setTrustedProxies()
1463+
Request::setTrustedProxies(array('3.3.3.4', '2.2.2.2'));
1464+
$this->assertEquals('3.3.3.3', $request->getClientIp());
1465+
$this->assertEquals('example.com', $request->getHost());
1466+
$this->assertEquals(80, $request->getPort());
1467+
$this->assertFalse($request->isSecure());
1468+
14581469
// check various X_FORWARDED_PROTO header values
1470+
Request::setTrustedProxies(array('3.3.3.3', '2.2.2.2'));
14591471
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
14601472
$this->assertTrue($request->isSecure());
14611473

0 commit comments

Comments
 (0)
0